UNKNOWN READ vulnerability in ghostscript: pdfi_dereference
Summary
OSV-2021-1726: UNKNOWN READ in pdfi_dereference. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. This vulnerability affects the ghostscript package and is related to an unknown read issue in the pdfi_dereference function. The vulnerability has a medium severity rating and was reported through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability involves an unknown read operation in the pdfi_dereference function of ghostscript. The exact cause and impact of the vulnerability are not specified in the provided information. However, it is mentioned that the crash state includes pdfi_deref_loop_detect and pdfi_dict_get functions. This vulnerability could potentially lead to arbitrary code execution or information disclosure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround is mentioned in the provided information. It is advised to follow the recommended fix and update the ghostscript package to mitigate the vulnerability.
Conclusion
In conclusion, the ghostscript package is affected by an unknown read vulnerability in the pdfi_dereference function. The exact impact and cause of the vulnerability are not specified, but it has a medium severity rating. It is recommended to update the ghostscript package to the latest version to mitigate the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting PDF files.
The impact of this vulnerability is not specified in the provided information. However, it could potentially lead to arbitrary code execution or information disclosure.
To fix this vulnerability, it is recommended to update the ghostscript package to the latest version available.
No specific workaround is mentioned in the provided information. It is advised to follow the recommended fix and update the ghostscript package.
More information about this vulnerability can be found in the OSS-Fuzz report linked in the provided information.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
